fraud_reportswikiaorg-20200214-history
Canadian RX Drugs
Description False Pretenses False: Secure link claim The site is now using the slightly different domain paymentrx.com, registered with eNom, and with SSL -- for as long as that lasts. But they have tipped their hand that they are willing to use deception to be able to take money while transmitting your medical information and credit card number in plain view. September 2011 At the bottom of the page is the "Support" link http://www.rx-order-support.com/ ut when you try to go there: Server not found Firefox can't find the server at http://www.rx-order-support.com. Looking up the domain name for the support for RX Promotions - Domain Name: RX-ORDER-SUPPORT.COM Registrar: INTERNET.BS CORP. Name Server: NS-CANADA.TOPDNS.COM Name Server: NS-UK.TOPDNS.COM Name Server: NS-USA.TOPDNS.COM Status: clientTransferProhibited Updated Date: 09-aug-2011 Creation Date: 09-aug-2011 Those name servers do not contain any information about the support site, which leads to the conclusion that it has been withdrawn ns-usa.topdns.com 216.67.232.70 that there is no a record for rx-order-support.com ns-canada.topdns.com 67.212.92.253 that there is no a record for rx-order-support.com ns-uk.topdns.com 83.170.72.109 that there is no a record for rx-order-support.com April 2010 Oct 2010 False: Claims to have "Pharma Checker" approval The fraud continues. Sites pretend to be authenticated by Pharmacy Checker - which they are not. So they set up a link to a fake Pharma Checker instead of the genuine Pharmacy Checker. Notice the fake logo on the left, compared with the genuine one on the right. Pharmacy Checker response We do not endorse this company and they are not affiliated with PharmacyChecker.com in any manner. The PharmacyChecker.com seal that they publish (“Pharma Checker”) is an unauthorized and adulterated copy. Donna Miller, Customer Services ---- False: Claim of "CIMA Rx" approval ---- False: Claim to be Canadian #Registrant addresses, when they are provided any at all, are never verifiable Canadian or even US addresses. #Name servers have IP addresses that show they are located in the Czech Republic or the Ukraine. #Web sites have been located at IP address 210.211.98.50 which is located in Viet Nam inetnum: 210.211.96.0 - 210.211.127.255 netname: VTDC-VNNIC-VN descr: Viettel-CHT Company Ltd descr: Hoa Lac Hitech Park, Km29, Lang Hoa Lac Road descr: Thach That, Ha Noi country: VN Lack of Pharmacist Oversight Numerous affiliate programs' pharma sites have begun competing for customers by putting "free Viagra" in the electronic shopping cart with every item ordered. (It's actually not real Viagra; whether it is even generic sildenafil is questionable.) Like the others, the Rx-promotions sites betray their complete lack of involvement of anyone with even the most minimal pharmacy training by including the "Viagra" when someone orders nitrate drugs -- a''' potentially lethal interaction'. There is more detail in the wiki article for Canadian Pharmacy and there is a photo documenting this practice here. Invalid contact details image:Canadian_RX_Contacts.jpg The domain name in this contact has been suspended by the registrar: Domain Name: DRUGSSUPPORT24.COM Registrar: ENOM, INC. Whois Server: whois.enom.com Referral URL: http://www.enom.com Name Server: BLOCKEDDUETOSPAM.PLEASECONTACTSUPPORT.COM Name Server: DUMMYSECONDARY.PLEASECONTACTSUPPORT.COM Status: '''clientHold' Updated Date: 14-apr-2010 Creation Date: 09-oct-2009 Expiration Date: 09-oct-2010 image:Canadian_RX_affiliates.jpg Affiliates also will have a problem making contact. The affilates web site has been suspended by the registrar: Domain Name: SPAMPROMO.COM Registrar: TODAYNIC.COM, INC. Whois Server: whois.todaynic.com Referral URL: http://www.NOW.CN Name Server: NS3.01ISP.COM Name Server: NS4.01ISP.NET Status: clientHold Status: clientTransferProhibited Updated Date: 27-dec-2009 Creation Date: 17-dec-2008 Expiration Date: 17-dec-2010 The web site at gives the contact address for Canadian RX Drugs as Suite 2, Portland House, Glacis Road, Gibraltar which is depicted in a photograph This address can also be found in a Google search: * Rogue antivirus distributor * Registered address of an Adult web site provider it has an IP address 91.212.135.134 which is located in Russia inetnum: 91.212.135.0 - 91.212.135.255 netname: YABA-NET descr: YabaMedia Ltd country: RU organisation: ORG-YL4-RIPE org-name: YabaMedia Ltd org-type: OTHER address: Shipilovskaya st. 18/1 address: Moscow, 120312, Russia e-mail: alexander@yabadaba.ru person: Alexander Andreev address: Shipilovskaya st. 18/1 address: Moscow, 120312, Russia phone: +7 925 8782503 e-mail: alexander@yabadaba.ru FDA Warning Letter The US Food and Drug Administration FDA) issued an official Warning Letter on October 8, 2010. Inspections, Compliance, Enforcement, and Criminal Investigations TO: support@rx-drugs-support.com FROM: Food and Drug Administration Internet Pharmacy Task Force RE: Internet Marketing of Unapproved and Misbranded Drugs DATE: October 8, 2010 Included in the letter were these Canadian Online Pharmacy sites, still operating 6 weeks later despite a deadline of 15 working days - * buy-oxycontin.us * buyoxycontin.us * buyoxycontinonline.us * cheapoxycontin.us * orderoxycontin.us * oxycontin-without-prescription.us * oxycontinbuy.us * oxycontinnoprescription.us * oxycontinwithoutprescription.us Extract: Acomplia (rimonabant) is well-known as the name of a drug previously approved in the European Union. It has never been approved by FDA, and in June 2007, FDA’s Endocrinologic and Metabolic Drugs Advisory Committee unanimously voted not to recommend approval of the drug because of increased risk of neurological and psychiatric side effects including seizures, depression, anxiety, insomnia, aggressiveness, and suicidal thoughts among patients. '' Spam Examples Subject: Subject: Friend ''username, enter our shop Izesgykeh The evolution of insect wings has been a subject of debate. Leung King, Tuen Mun Hospital, Fung Tei. http://xhx.rodolfodrugs.ru/?f825f2b53cb-5b61a83626e8-d3d163de635 Dragonfly naiads use jet propulsion, forcibly expelling water out of their rectal chamber. They included Wayne Gretzky, Mark Messier, Ken Linseman, and Mike Gartner. http://q.rodolfodrugs.ru/?7df68546302e-e41641c38bc-1d52413b5d1 Hosting Sites This has become a far more prevalent brand than before. In April 2010 the spam abuse rate increased to match or better that of Canadian Pharmacy Sample name server domains *aa1ns.ru *abrnswowk.ru *abvnameshere.ru *aebnstree.ru *akimdnservice.ru *alinanameserv.ru *alushyearns.ru *ansernameg.ru *aprnamesplace.ru *armfreenet.ru *arnamebz.ru *augnameservr.ru *azjnameserver.ru *g1ns.ru *gg2ns.com *gg9ns.com *hh4ns.com *o5nserv.ru *prnservme.ru URIBL lists of sites *aa1ns.ru http://rss.uribl.com/ns/aa1ns_ru.html *abrnswowk.ru http://rss.uribl.com/ns/abrnswowk_ru.html *abvnameshere.ru http://rss.uribl.com/ns/abvnameshere_ru.html *aebnstree.ru http://rss.uribl.com/ns/aebnstree_ru.html *akimdnservice.ru http://rss.uribl.com/ns/akimdnservice_ru.html *alinanameserv.ru http://rss.uribl.com/ns/alinanameserv_ru.html *alushyearns.ru http://rss.uribl.com/ns/alushyearns_ru.html *ansernameg.ru http://rss.uribl.com/ns/ansernameg_ru.html *aprnamesplace.ru http://rss.uribl.com/ns/aprnamesplace_ru.html *armfreenet.ru http://rss.uribl.com/ns/armfreenet_ru.html *arnamebz.ru http://rss.uribl.com/ns/arnamebz_ru.html *augnameservr.ru http://rss.uribl.com/ns/augnameservr_ru.html *azjnameserver.ru http://rss.uribl.com/ns/azjnameserver_ru.html *g1ns.ru http://rss.uribl.com/ns/g1ns_ru.html *gg2ns.com http://rss.uribl.com/ns/gg2ns_com.html *gg9ns.com http://rss.uribl.com/ns/gg9ns_com.html *hh4ns.com http://rss.uribl.com/ns/hh4ns_com.html *o5nserv.ru http://rss.uribl.com/ns/o5nserv_ru.html *prnservme.ru http://rss.uribl.com/ns/prnservme_ru.html Sample Name Server IP addresses CZ bad IPs - CERT email = cert@cert.cz *90.176.146.222 *188.130.250.227 *193.104.106.81 *193.104.106.82 *193.104.106.85 UA bad IPs - CERT email = cert@cert.gov.ua *91.206.201.6 *124.248.32.111 *193.104.12.125 *193.104.12.126 *193.104.12.127 *193.104.12.128 *202.165.179.23 How to report this spam The Complainterator is configured to request removal of these fraudulent sites. Add a link to this page as evidence. Send an email to the Czech and Ukraine country CERT teams at the email addresses shown above. Request that these illegal IP addresses be put in a routing black hole. Again, add a link here for the criminal evidence. Related spam operations Canadian Pharmacy and PharmSite share many similarities. A single agent may register domains for sale to multiple spam affiliate programs, so there may indeed be a connection. And there is likely plenty of plagiarism of things like images of fake seals. Category:Well-known Spam Category:Pharma spam|}